CVE-2026-108157 in Pingvin Share X
Summary
by MITRE • 10/09/2026
Pingvin Share X from 0.19.0 before 1.22.0 contains an improper authentication vulnerability that allows remote unauthenticated attackers to take over accounts by abusing automatic OAuth email linking in OAuthService.signUp(). Attackers can register a victim's unverified email on an enabled OAuth/OIDC provider, exploiting the missing email_verified check in GenericOidcProvider, to sign in as the victim including administrators while bypassing TOTP.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 10/09/2026
The vulnerability identified in Pingvin Share versions prior to 1.22.0 represents a critical failure in identity and access management controls, specifically within the OAuth/OpenID Connect authentication flow. This flaw stems from an improper implementation of account linking logic during user registration via third-party providers. The core technical deficiency lies in the GenericOidcProvider class, which fails to validate the email_verified attribute returned by the Identity Provider. In standard OpenID Connect implementations, this boolean flag indicates whether the identity provider has confirmed ownership of the provided email address. By omitting this check during the sign-up process executed through OAuthService.signUp(), the application accepts unverified emails as legitimate identifiers for new account creation or linking to existing accounts.
This architectural oversight allows remote attackers to perform unauthorized account takeover operations without possessing valid credentials for the target service. An attacker can register a victim's email address with an enabled OAuth provider, such as Google, GitHub, or other supported OIDC services, even if that email has not been verified by the identity provider itself. Because Pingvin Share trusts the email identifier provided in the authentication response without verifying its authenticity against the user's actual control of that inbox, it proceeds to link this unverified account to an existing local user profile associated with that same email address. This mechanism effectively bypasses traditional password-based and multi-factor authentication barriers, including Time-Based One-Time Password (TOTP) protections, as the attacker gains access through the trusted OAuth channel rather than by cracking credentials or intercepting MFA codes.
The operational impact of this vulnerability is severe, particularly given Pingvin Share's role in managing file sharing operations which may involve sensitive data. An unauthenticated remote actor can gain full administrative privileges if they target an administrator account linked to a vulnerable email address. This compromise undermines the integrity of the entire system, allowing for unauthorized access to shared files, potential data exfiltration, and manipulation of user settings or other users' accounts. The ability to bypass TOTP highlights a fundamental flaw in assuming that OAuth authentication alone provides sufficient assurance of identity when account linking logic is not rigorously enforced against unverified claims from external providers.
From a classification perspective, this vulnerability aligns with CWE-287: Improper Authentication and CWE-613: Insufficient Session Expiration or Termination if the session remains active after such unauthorized linkage. It also maps to MITRE ATT&CK technique T1078: Valid Accounts, specifically the sub-technique of using legitimate credentials obtained through social engineering or account takeover mechanisms. The exploitation relies on abusing trust relationships between services and failing to validate critical identity attributes before granting access.
To mitigate this risk, immediate updates to Pingvin Share version 1.22.0 or later are required, as these versions address the missing validation logic within the OAuth service layer. Administrators should ensure that their deployment is patched against this specific flaw in GenericOidcProvider. Additionally, organizations relying on similar self-hosted file sharing solutions should audit their authentication configurations to ensure that email verification status from identity providers is strictly enforced before allowing account linking or creation. Implementing strict validation of the email_verified claim and requiring explicit user confirmation for any cross-provider account associations can prevent this class of vulnerability in future deployments.